CVE Vulnerability Catalog

A security vulnerability has been detected in Presenton up to 0.9.11-beta. It affects an unknown part of the /app_data file in the Desktop Authentication Middleware component and leads to information disclosure. The attack can be launched remotely, and a public exploit is already available.

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). A crafted file can overflow the 32-entry HufVal and HufSz stack arrays and crash the calling process.

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size(). An attacker can supply a crafted CCITT Group 4 stream lacking EOFB, causing the calling process to hang and consume full CPU.

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. A network-positioned attacker can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. An attacker can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags.

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. An SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory can execute scripts against visitors and higher-privileged administrators.

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows leaking heap memory into decoded pixels via short packed-BGR bitstreams. A crafted Huffyuv BGR24/BGRA video can cause decode_slice() to add uninitialized s->temp[0] bytes into output frames.

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. A crafted type-0 CDXL file can expose stack bytes and pointer fragments in the BGR24 output.

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. A crafted truncated Sun Raster file can cause the uncleared temporary bitmap to be expanded into PAL8 pixels, exposing stale heap contents.

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the Submission Description Editor component. The manipulation results in cross site scripting, and the attack may be performed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in D-Link DIR-505 1.10B02 in the save_upload_file/mp_upload_file function of /usr/bin/tftpd, which handles TFTP upload filenames. Manipulation of input leads to a stack-based buffer overflow. The attack can be carried out remotely, and a public exploit is available and might be used.

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. The bundled copy (1.0.7 or 1.1.0) carries the vulnerability described in CVE-2026-111497, and the decoder is reachable through dependent modules that decompress untrusted data.

A security flaw was discovered in YznCMS up to version 2.2.0 in the Backend function of app/admin/controller/auth/Group.php (Auth Group Handler component). Manipulation results in improper privilege management. The attack can be initiated remotely, and upgrading to version 2.2.1 fixes the issue.

An uncontrolled recursion vulnerability exists in the Apache Thrift Java bindings. The issue affects Apache Thrift versions before 0.24.0. It is fixed in version 0.24.0.

The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.

CVE-2026-118147 is an improper certificate validation vulnerability in Visual Studio. An unauthorized attacker can exploit this flaw to perform spoofing over a network.

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.